Characteristics
-
Turns off anti virus applications
-
Installs itself in the registry
-
Opens links to websites
Affected Operating Systems
Recovery Instructions:
Please follow the instructions for removing worms.
The following registry entries should be restored manually:
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
The following registry entries should be deleted manually:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<path to security software>
Debugger
<Windows>\<randomname>.exe